Page List Vulnerabilities

The Page-list plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.2. This is due to the pagelist_unqprfx_ext_shortcode() function (the [pagelist_ext] / [pagelistext] shortcode) accepting attacker-controlled post_status, post_type, and show_meta_key attributes and passing...

CVSS:

4.3

Affected:

up to 6.2

Fixed in:

6.3

Disclosed:

Jun 5, 2026

CVE-2026-9008 on NVD →

The Page-list plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wil...

CVSS:

6.4

Affected:

up to 5.8

Fixed in:

5.9

Disclosed:

Sep 22, 2025

CVE-2025-58030 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webvitaly Page-list allows Stored XSS.This issue affects Page-list: from n/a through 5.6.

Affected:

up to 5.7

Fixed in:

5.7

Disclosed:

Oct 5, 2024

CVE-2024-47382 on NVD →

The Page-list plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wil...

CVSS:

6.4

Affected:

up to 5.6

Fixed in:

5.7

Disclosed:

Sep 30, 2024

CVE-2024-47382 on NVD →

[en] The Page-list WordPress plugin before 5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Affected:

up to 5.3

Fixed in:

5.3

Disclosed:

Jan 23, 2023

CVE-2022-4485 on NVD →

The Page-list plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode in versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web script...

CVSS:

6.4

Affected:

up to 5.2

Fixed in:

5.3

Disclosed:

Dec 27, 2022

CVE-2022-4485 on NVD →

Affected:

up to 5.8

Fix:

No patched version reported

CVE-2025-58030 on NVD →